Store ipset storage method and matches in state file, keep iprange and ports if set
[project/firewall3.git] / ipsets.c
1 /*
2  * firewall3 - 3rd OpenWrt UCI firewall implementation
3  *
4  *   Copyright (C) 2013 Jo-Philipp Wich <jow@openwrt.org>
5  *
6  * Permission to use, copy, modify, and/or distribute this software for any
7  * purpose with or without fee is hereby granted, provided that the above
8  * copyright notice and this permission notice appear in all copies.
9  *
10  * THE SOFTWARE IS PROVIDED "AS IS" AND THE AUTHOR DISCLAIMS ALL WARRANTIES
11  * WITH REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF
12  * MERCHANTABILITY AND FITNESS. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR
13  * ANY SPECIAL, DIRECT, INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES
14  * WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN
15  * ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF
16  * OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
17  */
18
19 #include "ipsets.h"
20
21
22 const struct fw3_option fw3_ipset_opts[] = {
23         FW3_OPT("enabled",       bool,           ipset,     enabled),
24
25         FW3_OPT("name",          string,         ipset,     name),
26         FW3_OPT("family",        family,         ipset,     family),
27
28         FW3_OPT("storage",       ipset_method,   ipset,     method),
29         FW3_LIST("match",        ipset_datatype, ipset,     datatypes),
30
31         FW3_OPT("iprange",       address,        ipset,     iprange),
32         FW3_OPT("portrange",     port,           ipset,     portrange),
33
34         FW3_OPT("netmask",       int,            ipset,     netmask),
35         FW3_OPT("maxelem",       int,            ipset,     maxelem),
36         FW3_OPT("hashsize",      int,            ipset,     hashsize),
37         FW3_OPT("timeout",       int,            ipset,     timeout),
38
39         FW3_OPT("external",      string,         ipset,     external),
40
41         { }
42 };
43
44 #define T(m, t1, t2, t3, r, o) \
45         { FW3_IPSET_METHOD_##m, \
46           FW3_IPSET_TYPE_##t1 | (FW3_IPSET_TYPE_##t2 << 8) | (FW3_IPSET_TYPE_##t3 << 16), \
47           r, o }
48
49 enum ipset_optflag {
50         OPT_IPRANGE   = (1 << 0),
51         OPT_PORTRANGE = (1 << 1),
52         OPT_NETMASK   = (1 << 2),
53         OPT_HASHSIZE  = (1 << 3),
54         OPT_MAXELEM   = (1 << 4),
55         OPT_FAMILY    = (1 << 5),
56 };
57
58 struct ipset_type {
59         enum fw3_ipset_method method;
60         uint32_t types;
61         uint8_t required;
62         uint8_t optional;
63 };
64
65 static struct ipset_type ipset_types[] = {
66         T(BITMAP, IP,   UNSPEC, UNSPEC, OPT_IPRANGE, OPT_NETMASK),
67         T(BITMAP, IP,   MAC,    UNSPEC, OPT_IPRANGE, 0),
68         T(BITMAP, PORT, UNSPEC, UNSPEC, OPT_PORTRANGE, 0),
69
70         T(HASH,   IP,   UNSPEC, UNSPEC, 0,
71           OPT_FAMILY | OPT_HASHSIZE | OPT_MAXELEM | OPT_NETMASK),
72         T(HASH,   NET,  UNSPEC, UNSPEC, 0,
73           OPT_FAMILY | OPT_HASHSIZE | OPT_MAXELEM),
74         T(HASH,   IP,   PORT,   UNSPEC, 0,
75           OPT_FAMILY | OPT_HASHSIZE | OPT_MAXELEM),
76         T(HASH,   NET,  PORT,   UNSPEC, 0,
77           OPT_FAMILY | OPT_HASHSIZE | OPT_MAXELEM),
78         T(HASH,   IP,   PORT,   IP,     0,
79           OPT_FAMILY | OPT_HASHSIZE | OPT_MAXELEM),
80         T(HASH,   IP,   PORT,   NET,    0,
81           OPT_FAMILY | OPT_HASHSIZE | OPT_MAXELEM),
82
83         T(LIST,   SET,  UNSPEC, UNSPEC, 0, OPT_MAXELEM),
84 };
85
86
87 static bool
88 check_types(struct uci_element *e, struct fw3_ipset *ipset)
89 {
90         int i = 0;
91         uint32_t typelist = 0;
92         struct fw3_ipset_datatype *type;
93
94         list_for_each_entry(type, &ipset->datatypes, list)
95         {
96                 if (i >= 3)
97                 {
98                         warn_elem(e, "must not have more than 3 datatypes assigned");
99                         return false;
100                 }
101
102                 typelist |= (type->type << (i++ * 8));
103         }
104
105         /* find a suitable storage method if none specified */
106         if (ipset->method == FW3_IPSET_METHOD_UNSPEC)
107         {
108                 for (i = 0; i < ARRAY_SIZE(ipset_types); i++)
109                 {
110                         if (ipset_types[i].types == typelist)
111                         {
112                                 ipset->method = ipset_types[i].method;
113
114                                 warn_elem(e, "defines no storage method, assuming '%s'",
115                                           fw3_ipset_method_names[ipset->method]);
116
117                                 break;
118                         }
119                 }
120         }
121
122         //typelist |= ipset->method;
123
124         for (i = 0; i < ARRAY_SIZE(ipset_types); i++)
125         {
126                 if (ipset_types[i].method == ipset->method &&
127                     ipset_types[i].types == typelist)
128                 {
129                         if (!ipset->external || !*ipset->external)
130                         {
131                                 if ((ipset_types[i].required & OPT_IPRANGE) &&
132                                         !ipset->iprange.set)
133                                 {
134                                         warn_elem(e, "requires an ip range");
135                                         return false;
136                                 }
137
138                                 if ((ipset_types[i].required & OPT_PORTRANGE) &&
139                                     !ipset->portrange.set)
140                                 {
141                                         warn_elem(e, "requires a port range");
142                                         return false;
143                                 }
144
145                                 if (!(ipset_types[i].required & OPT_IPRANGE) &&
146                                     ipset->iprange.set)
147                                 {
148                                         warn_elem(e, "iprange ignored");
149                                         ipset->iprange.set = false;
150                                 }
151
152                                 if (!(ipset_types[i].required & OPT_PORTRANGE) &&
153                                     ipset->portrange.set)
154                                 {
155                                         warn_elem(e, "portrange ignored");
156                                         ipset->portrange.set = false;
157                                 }
158
159                                 if (!(ipset_types[i].optional & OPT_NETMASK) &&
160                                     ipset->netmask > 0)
161                                 {
162                                         warn_elem(e, "netmask ignored");
163                                         ipset->netmask = 0;
164                                 }
165
166                                 if (!(ipset_types[i].optional & OPT_HASHSIZE) &&
167                                     ipset->hashsize > 0)
168                                 {
169                                         warn_elem(e, "hashsize ignored");
170                                         ipset->hashsize = 0;
171                                 }
172
173                                 if (!(ipset_types[i].optional & OPT_MAXELEM) &&
174                                     ipset->maxelem > 0)
175                                 {
176                                         warn_elem(e, "maxelem ignored");
177                                         ipset->maxelem = 0;
178                                 }
179
180                                 if (!(ipset_types[i].optional & OPT_FAMILY) &&
181                                     ipset->family != FW3_FAMILY_ANY)
182                                 {
183                                         warn_elem(e, "family ignored");
184                                         ipset->family = FW3_FAMILY_ANY;
185                                 }
186                         }
187
188                         return true;
189                 }
190         }
191
192         warn_elem(e, "has an invalid combination of storage method and matches");
193         return false;
194 }
195
196 struct fw3_ipset *
197 fw3_alloc_ipset(void)
198 {
199         struct fw3_ipset *ipset;
200
201         ipset = malloc(sizeof(*ipset));
202
203         if (!ipset)
204                 return NULL;
205
206         memset(ipset, 0, sizeof(*ipset));
207
208         INIT_LIST_HEAD(&ipset->datatypes);
209
210         ipset->enabled = true;
211
212         return ipset;
213 }
214
215 void
216 fw3_load_ipsets(struct fw3_state *state, struct uci_package *p)
217 {
218         struct uci_section *s;
219         struct uci_element *e;
220         struct fw3_ipset *ipset;
221
222         INIT_LIST_HEAD(&state->ipsets);
223
224         if (state->disable_ipsets)
225                 return;
226
227         uci_foreach_element(&p->sections, e)
228         {
229                 s = uci_to_section(e);
230
231                 if (strcmp(s->type, "ipset"))
232                         continue;
233
234                 ipset = fw3_alloc_ipset();
235
236                 if (!ipset)
237                         continue;
238
239                 fw3_parse_options(ipset, fw3_ipset_opts, s);
240
241                 if (!ipset->name || !*ipset->name)
242                 {
243                         warn_elem(e, "must have a name assigned");
244                 }
245                 //else if (fw3_lookup_ipset(state, ipset->name) != NULL)
246                 //{
247                 //      warn_elem(e, "has duplicated set name '%s'", ipset->name);
248                 //}
249                 else if (list_empty(&ipset->datatypes))
250                 {
251                         warn_elem(e, "has no datatypes assigned");
252                 }
253                 else if (check_types(e, ipset))
254                 {
255                         list_add_tail(&ipset->list, &state->ipsets);
256                         continue;
257                 }
258
259                 fw3_free_ipset(ipset);
260         }
261 }
262
263
264 static void
265 create_ipset(struct fw3_ipset *ipset, struct fw3_state *state)
266 {
267         bool first = true;
268
269         struct fw3_ipset_datatype *type;
270
271         if (ipset->external && *ipset->external)
272                 return;
273
274         info(" * Creating ipset %s", ipset->name);
275
276         first = true;
277         fw3_pr("create %s %s", ipset->name, fw3_ipset_method_names[ipset->method]);
278
279         list_for_each_entry(type, &ipset->datatypes, list)
280         {
281                 fw3_pr("%c%s", first ? ':' : ',', fw3_ipset_type_names[type->type]);
282                 first = false;
283         }
284
285         if (ipset->iprange.set)
286         {
287                 fw3_pr(" range %s", fw3_address_to_string(&ipset->iprange, false));
288         }
289         else if (ipset->portrange.set)
290         {
291                 fw3_pr(" range %u-%u",
292                        ipset->portrange.port_min, ipset->portrange.port_max);
293         }
294
295         if (ipset->family != FW3_FAMILY_ANY)
296                 fw3_pr(" family inet%s", (ipset->family == FW3_FAMILY_V4) ? "" : "6");
297
298         if (ipset->timeout > 0)
299                 fw3_pr(" timeout %u", ipset->timeout);
300
301         if (ipset->maxelem > 0)
302                 fw3_pr(" maxelem %u", ipset->maxelem);
303
304         if (ipset->netmask > 0)
305                 fw3_pr(" netmask %u", ipset->netmask);
306
307         if (ipset->hashsize > 0)
308                 fw3_pr(" hashsize %u", ipset->hashsize);
309
310         fw3_pr("\n");
311 }
312
313 void
314 fw3_create_ipsets(struct fw3_state *state)
315 {
316         struct fw3_ipset *ipset;
317
318         if (state->disable_ipsets)
319                 return;
320
321         list_for_each_entry(ipset, &state->ipsets, list)
322                 create_ipset(ipset, state);
323
324         fw3_pr("quit\n");
325 }
326
327 void
328 fw3_destroy_ipsets(struct fw3_state *state)
329 {
330         struct fw3_ipset *s;
331
332         list_for_each_entry(s, &state->ipsets, list)
333         {
334                 info(" * Deleting ipset %s", s->name);
335
336                 fw3_pr("flush %s\n", s->name);
337                 fw3_pr("destroy %s\n", s->name);
338         }
339
340         fw3_pr("quit\n");
341 }
342
343 struct fw3_ipset *
344 fw3_lookup_ipset(struct fw3_state *state, const char *name)
345 {
346         struct fw3_ipset *s;
347
348         if (list_empty(&state->ipsets))
349                 return NULL;
350
351         list_for_each_entry(s, &state->ipsets, list)
352         {
353                 if (strcmp(s->name, name))
354                         continue;
355
356                 return s;
357         }
358
359         return NULL;
360 }